RoleManagement.ReadWrite.Exchange

const options = {
	authProvider,
};

const client = Client.init(options);

const customAppScope = {
    type: 'RecipientScope',
    displayName: 'Protected Exec Users',
    customAttributes: {
        Exclusive: false,
        RecipientFilter: 'Title -like \'VP*\''
    }
};

await client.api('/roleManagement/exchange/customAppScopes')
	.version('beta')
	.post(customAppScope);

Import-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment

$params = @{
	type = "RecipientScope"
	displayName = "Protected Exec Users"
	customAttributes = @{
		Exclusive = $false
		RecipientFilter = "Title -like 'VP*'"
	}
}

New-MgBetaRoleManagementExchangeCustomAppScope -BodyParameter $params

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.custom_app_scope import CustomAppScope
from msgraph_beta.generated.models.custom_app_scope_attributes_dictionary import CustomAppScopeAttributesDictionary
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CustomAppScope(
	type = "RecipientScope",
	display_name = "Protected Exec Users",
	custom_attributes = CustomAppScopeAttributesDictionary(
		additional_data = {
				"exclusive" : False,
				"recipient_filter" : "Title -like 'VP*'",
		}
	),
)

result = await graph_client.role_management.exchange.custom_app_scopes.post(request_body)